Corsair M65 RGB Ultra mouse review
Asus ROG STRIX XG43UQ monitor review
Netduma R2 router review
TerraMaster F5-422 NAS Review
Radeon RX 6600 (Sapphire Pulse) review
Radeon RX 6600 (Gigabyte Eagle 8G) review
PowerColor Radeon RX 6900 XT Red Devil review
Corsair Sabre RGB Pro Wireless mouse review
Far Cry 6: PC graphics performance benchmark review
Colorful GeForce RTX 3060 Bilibili 12G review
GhostDNS: 70+ different types of home routers (100,000+) are being hijacked
Over a 100K routers from brands like D-Link, MikroTik, TP-Link, Huawei and SpeedTouch are currently hijacked and have a changed the DNS server. That way traffic can be re-routed ending up at phishing sites etc.
While not a new methodology, from the 20th of September of this year a large attack was discovered by security researchers. So basically on a malicious website, a script would be executed that sniffs if your router port is open, try to log in (brute force) to your router, that changes credentials and DNS. A lot of users use the default username and password which makes them extra vulnerable. Once the criminals are able to login they change the DNS server address of the router. Currently, the attacks are mainly active in Brazil.
The current attack, discovered by network security lab 360 Netlab, affects more than 70 different routers:
- 3COM OCR-812
- AP-ROUTER
- D-LINK
- D-LINK DSL-2640T
- D-LINK DSL-2740R
- D-LINK DSL-500
- D-LINK DSL-500G/DSL-502G
- Huawei SmartAX MT880a
- Intelbras WRN240-1
- Kaiomy Router
- MikroTiK Routers
- OIWTECH OIW-2415CPE
- Ralink Routers
- SpeedStream
- SpeedTouch
- Tenda
- TP-LINK TD-W8901G/TD-W8961ND/TD-8816
- TP-LINK TD-W8960N
- TP-LINK TL-WR740N
- TRIZ TZ5500E/VIKING
- VIKING/DSLINK 200 U/E
In total, more than 100,000 routers are affected by the attack of which the majority is located in Brazil. As soon as the users browse to specific websites they are redirected to phishing sites. These include online banking sites but also Netflix and hosting companies.
Once again, make sure your router firmware is up-to-date, disable external WAN access, and change your default password.
slyphnier
Senior Member
Posts: 813
Joined: 2009-11-30
Senior Member
Posts: 813
Joined: 2009-11-30
#5591150 Posted on: 10/02/2018 01:41 PM
What a day we live in today..... So many hardware/software vulnerabilities out there its simply amazing anything is up and running ATM. Anything......
Just crazy.....!!
well ATM basically LAN (enclosed-wan) that only connect to banking-network
which separate them from internet-open-world
thats why they not effected much by real-world vulnerabilites... even though probably they share same vulnerabilites
What a day we live in today..... So many hardware/software vulnerabilities out there its simply amazing anything is up and running ATM. Anything......
Just crazy.....!!
well ATM basically LAN (enclosed-wan) that only connect to banking-network
which separate them from internet-open-world
thats why they not effected much by real-world vulnerabilites... even though probably they share same vulnerabilites
Steppzor
Senior Member
Posts: 823
Joined: 2006-02-05
Senior Member
Posts: 823
Joined: 2006-02-05
#5591162 Posted on: 10/02/2018 02:16 PM
Think he ment 'At The Moment' xD
Think he ment 'At The Moment' xD
Brasky
Senior Member
Posts: 2324
Joined: 2011-05-19
Senior Member
Posts: 2324
Joined: 2011-05-19
#5591172 Posted on: 10/02/2018 02:58 PM
Thanks Ron Burgundy! now i know why you're the most trusted name in San Diego!
Think he ment 'At The Moment' xD
Thanks Ron Burgundy! now i know why you're the most trusted name in San Diego!
Mateja
Senior Member
Posts: 101
Joined: 2014-02-01
Senior Member
Posts: 101
Joined: 2014-02-01
#5591209 Posted on: 10/02/2018 04:28 PM
and lo ~ I have a router update! thnx for the heads up! (even updated just a month ago).
if anyone needs help do this:
open file explorer (the folder icon on the taskbar)
click "network" on the left
in windows 10, my wifi router appears under "network infrastructure" as "R7000 (Gateway)"
right click that > "view device webpage"
if it's netgear, The user name is admin, and the password is password
you may see a flag to update firmware at the top of that main page, if not,
click "advanced" tab > click "administration" on the left > "router update"
again, you should see update firmware, but if not click "check"
let it take the time to update and reset your router (no internet for a minute while it resets)
as for your cable modem, google your device model number. if it's like mine, it says that firmware updates are pushed by your ISP so no worries there
other tips to maximize security:
- there may be an option to auto update on your router page (expect to be kicked offline sometimes but who knows maybe it's smarter and knows your idle time like windows 10 updates now)
- keep windows up to date (type 'check for updates' on windows 10 search bar) > click "check now" if they don't appear already
- keep your pc up to date w/ manufacturer software (for me it's the "Lenovo vantage" windows 10 app. this pc updates its bios etc a lot)
- use a wired connection directly from your cable modem to your newest PC (a new chipset that's designed to not have spectre and meltdown vulnerabilities etc).
and lo ~ I have a router update! thnx for the heads up! (even updated just a month ago).
if anyone needs help do this:
open file explorer (the folder icon on the taskbar)
click "network" on the left
in windows 10, my wifi router appears under "network infrastructure" as "R7000 (Gateway)"
right click that > "view device webpage"
if it's netgear, The user name is admin, and the password is password
you may see a flag to update firmware at the top of that main page, if not,
click "advanced" tab > click "administration" on the left > "router update"
again, you should see update firmware, but if not click "check"
let it take the time to update and reset your router (no internet for a minute while it resets)
as for your cable modem, google your device model number. if it's like mine, it says that firmware updates are pushed by your ISP so no worries there
other tips to maximize security:
- there may be an option to auto update on your router page (expect to be kicked offline sometimes but who knows maybe it's smarter and knows your idle time like windows 10 updates now)
- keep windows up to date (type 'check for updates' on windows 10 search bar) > click "check now" if they don't appear already
- keep your pc up to date w/ manufacturer software (for me it's the "Lenovo vantage" windows 10 app. this pc updates its bios etc a lot)
- use a wired connection directly from your cable modem to your newest PC (a new chipset that's designed to not have spectre and meltdown vulnerabilities etc).
Click here to post a comment for this news story on the message forum.
Senior Member
Posts: 1280
Joined: 2011-01-11
What a day we live in today..... So many hardware/software vulnerabilities out there its simply amazing anything is up and running ATM. Anything......
Just crazy.....!!